What should I ask a cloud specialist to help me establish?¶

Ask a cloud specialist to explain the source, meaning, completeness and limitations of the technical records - and to identify what additional evidence could test the competing explanations. Their role is not to confirm an existing case theory or decide intent and responsibility.

Frame a technical question¶

State the operational or evidential decision that needs support. Provide original exports, provider definitions, known identifiers, collection notes and a timeline rather than only screenshots or a narrative summary.

A specialist may help establish:

• which systems generated each event and what their fields mean;
• how authentication, sessions, tokens, applications, devices and resources connect;
• whether activity was interactive, automated, synchronised or provider-generated;
• what logging, retention, permission or export gaps exist; and
• what containment or collection actions may have changed the records.

Agree potentially ambiguous terminology such as login, access, device and location. Product interfaces may use those labels differently from an evidential report.

Require bounded conclusions¶

Ask the specialist to identify assumptions, undocumented provider behaviour, uncertainties and plausible alternatives. Where an opinion depends on current product configuration rather than the historical state, that distinction should be explicit.

Technical evidence may link an event to an account, session or device identifier without identifying the person in control. Wider device, organisational or real-world evidence may still be needed for attribution.